Re: [PATCH] x86/efi: defer freeing of boot services memory

[Mike Rapoport <rppt@kernel.org>]

Hi Ard,

On Mon, Feb 23, 2026 at 09:08:29AM +0100, Ard Biesheuvel wrote:
> Hi Mike,
> 
> On Mon, 23 Feb 2026, at 08:52, Mike Rapoport wrote:
> > From: "Mike Rapoport (Microsoft)" <rppt@kernel.org>
> >
> > efi_free_boot_services() frees memory occupied by EFI_BOOT_SERVICES_CODE
> > and EFI_BOOT_SERVICES_DATA using memblock_free_late().
> >
> > There are two issue with that: memblock_free_late() should be used for
> > memory allocated with memblock_alloc() while the memory reserved with
> > memblock_reserve() should be freed with free_reserved_area().
> >
> > More acutely, with CONFIG_DEFERRED_STRUCT_PAGE_INIT=y
> > efi_free_boot_services() is called before deferred initialization of the
> > memory map is complete.
> >
> > Benjamin Herrenschmidt reports that this causes a leak of ~140MB of
> > RAM on EC2 t3a.nano instances which only have 512MB or RAM.
> >
> > If the freed memory resides in the areas that memory map for them is
> > still uninitialized, they won't be actually freed because
> > memblock_free_late() calls memblock_free_pages() and the latter skips
> > uninitialized pages.
> >
> > Using free_reserved_area() at this point is also problematic because
> > __free_page() accesses the buddy of the freed page and that again might
> > end up in uninitialized part of the memory map.
> >
> > Delaying the entire efi_free_boot_services() could be problematic
> > because in addition to freeing boot services memory it updates
> > efi.memmap without any synchronization and that's undesirable late in
> > boot when there is concurrency.
> >
> > More robust approach is to only defer freeing of the EFI boot services
> > memory.
> >
> > Make efi_free_boot_services() collect ranges that should be freed into
> > an array and add an initcall efi_free_boot_services_memory() that walks
> > that array and actually frees the memory using free_reserved_area().
> >
> 
> Instead of creating another table, could we just traverse the EFI memory
> map again in the arch_initcall(), and free all boot services code/data
> above 1M with EFI_MEMORY_RUNTIME cleared ?
 
Currently efi_free_boot_services() unmaps all boot services code/data with
EFI_MEMORY_RUNTIME cleared and removes them from the efi.memmap.

I wasn't sure it's Ok to only unmap them, but leave in efi.memmap, that's
why I didn't use the existing EFI memory map.

Now thinking about it, if the unmapping can happen later, maybe we'll just
move the entire efi_free_boot_services() to an initcall?

> > Link: 
> > https://lore.kernel.org/all/ec2aaef14783869b3be6e3c253b2dcbf67dbc12a.camel@kernel.crashing.org
> > Fixes: 916f676f8dc0 ("x86, efi: Retain boot service code until after 
> > switching to virtual mode")
> > Cc: <stable@vger.kernel.org>
> > Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
> > ---
> >  arch/x86/include/asm/efi.h          |  2 +-
> >  arch/x86/platform/efi/efi.c         |  2 +-
> >  arch/x86/platform/efi/quirks.c      | 55 +++++++++++++++++++++++++++--
> >  drivers/firmware/efi/mokvar-table.c |  2 +-
> >  4 files changed, 55 insertions(+), 6 deletions(-)
> >
> > diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h
> > index f227a70ac91f..51b4cdbea061 100644
> > --- a/arch/x86/include/asm/efi.h
> > +++ b/arch/x86/include/asm/efi.h
> > @@ -138,7 +138,7 @@ extern void __init efi_apply_memmap_quirks(void);
> >  extern int __init efi_reuse_config(u64 tables, int nr_tables);
> >  extern void efi_delete_dummy_variable(void);
> >  extern void efi_crash_gracefully_on_page_fault(unsigned long phys_addr);
> > -extern void efi_free_boot_services(void);
> > +extern void efi_unmap_boot_services(void);
> > 
> >  void arch_efi_call_virt_setup(void);
> >  void arch_efi_call_virt_teardown(void);
> > diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
> > index d00c6de7f3b7..d84c6020dda1 100644
> > --- a/arch/x86/platform/efi/efi.c
> > +++ b/arch/x86/platform/efi/efi.c
> > @@ -836,7 +836,7 @@ static void __init __efi_enter_virtual_mode(void)
> >  	}
> > 
> >  	efi_check_for_embedded_firmwares();
> > -	efi_free_boot_services();
> > +	efi_unmap_boot_services();
> > 
> >  	if (!efi_is_mixed())
> >  		efi_native_runtime_setup();
> > diff --git a/arch/x86/platform/efi/quirks.c b/arch/x86/platform/efi/quirks.c
> > index 553f330198f2..35caa5746115 100644
> > --- a/arch/x86/platform/efi/quirks.c
> > +++ b/arch/x86/platform/efi/quirks.c
> > @@ -341,7 +341,7 @@ void __init efi_reserve_boot_services(void)
> > 
> >  		/*
> >  		 * Because the following memblock_reserve() is paired
> > -		 * with memblock_free_late() for this region in
> > +		 * with free_reserved_area() for this region in
> >  		 * efi_free_boot_services(), we must be extremely
> >  		 * careful not to reserve, and subsequently free,
> >  		 * critical regions of memory (like the kernel image) or
> > @@ -404,17 +404,33 @@ static void __init efi_unmap_pages(efi_memory_desc_t *md)
> >  		pr_err("Failed to unmap VA mapping for 0x%llx\n", va);
> >  }
> > 
> > -void __init efi_free_boot_services(void)
> > +struct efi_freeable_range {
> > +	u64 start;
> > +	u64 end;
> > +};
> > +
> > +static struct efi_freeable_range *ranges_to_free;
> > +
> > +void __init efi_unmap_boot_services(void)
> >  {
> >  	struct efi_memory_map_data data = { 0 };
> >  	efi_memory_desc_t *md;
> >  	int num_entries = 0;
> > +	int idx = 0;
> > +	size_t sz;
> >  	void *new, *new_md;
> > 
> >  	/* Keep all regions for /sys/kernel/debug/efi */
> >  	if (efi_enabled(EFI_DBG))
> >  		return;
> > 
> > +	sz = sizeof(*ranges_to_free) * efi.memmap.nr_map + 1;
> > +	ranges_to_free = kzalloc(sz, GFP_KERNEL);
> > +	if (!ranges_to_free) {
> > +		pr_err("Failed to allocate storage for freeable EFI regions\n");
> > +		return;
> > +	}
> > +
> >  	for_each_efi_memory_desc(md) {
> >  		unsigned long long start = md->phys_addr;
> >  		unsigned long long size = md->num_pages << EFI_PAGE_SHIFT;
> > @@ -471,7 +487,15 @@ void __init efi_free_boot_services(void)
> >  			start = SZ_1M;
> >  		}
> > 
> > -		memblock_free_late(start, size);
> > +		/*
> > +		 * With CONFIG_DEFERRED_STRUCT_PAGE_INIT parts of the memory
> > +		 * map are still not initialized and we can't reliably free
> > +		 * memory here.
> > +		 * Queue the ranges to free at a later point.
> > +		 */
> > +		ranges_to_free[idx].start = start;
> > +		ranges_to_free[idx].end = start + size;
> > +		idx++;
> >  	}
> > 
> >  	if (!num_entries)
> > @@ -512,6 +536,31 @@ void __init efi_free_boot_services(void)
> >  	}
> >  }
> > 
> > +static int __init efi_free_boot_services(void)
> > +{
> > +	struct efi_freeable_range *range = ranges_to_free;
> > +	unsigned long freed = 0;
> > +
> > +	if (!ranges_to_free)
> > +		return 0;
> > +
> > +	while (range->start) {
> > +		void *start = phys_to_virt(range->start);
> > +		void *end = phys_to_virt(range->end);
> > +
> > +		free_reserved_area(start, end, -1, NULL);
> > +		freed += (end - start);
> > +		range++;
> > +	}
> > +	kfree(ranges_to_free);
> > +
> > +	if (freed)
> > +		pr_info("Freeing EFI boot services memory: %ldK\n", freed / SZ_1K);
> > +
> > +	return 0;
> > +}
> > +arch_initcall(efi_free_boot_services);
> > +
> >  /*
> >   * A number of config table entries get remapped to virtual addresses
> >   * after entering EFI virtual mode. However, the kexec kernel requires
> > diff --git a/drivers/firmware/efi/mokvar-table.c 
> > b/drivers/firmware/efi/mokvar-table.c
> > index 4ff0c2926097..6842aa96d704 100644
> > --- a/drivers/firmware/efi/mokvar-table.c
> > +++ b/drivers/firmware/efi/mokvar-table.c
> > @@ -85,7 +85,7 @@ static struct kobject *mokvar_kobj;
> >   * as an alternative to ordinary EFI variables, due to 
> > platform-dependent
> >   * limitations. The memory occupied by this table is marked as 
> > reserved.
> >   *
> > - * This routine must be called before efi_free_boot_services() in order
> > + * This routine must be called before efi_unmap_boot_services() in 
> > order
> >   * to guarantee that it can mark the table as reserved.
> >   *
> >   * Implicit inputs:
> >
> > base-commit: 6de23f81a5e08be8fbf5e8d7e9febc72a5b5f27f
> > -- 
> > 2.51.0

-- 
Sincerely yours,
Mike.